It is widely known that the importance of technologies for specifying the irregular location occurring in a network has been increased with an increase in each of the complication and the diversification of network configurations. As one of the above-described technologies, the network tomography analysis performed to analyze the irregular location occurring in a network based on information illustrating the quality of a measured flow of a packet exchanged between ends has been available. Hereinafter, the network tomography analysis will be described. FIG. 15 illustrates a network system subjected to the network tomography analysis.
The network system illustrated in FIG. 15 includes a server 91, a plurality of terminal apparatuses 94 connected to the server 91 via a network, a tap 92, and a monitoring apparatus 93. In the network, the tap 92 can acquire the entire data exchanged between the server 91 and the terminal apparatuses 94. The monitoring apparatus 93 acquires a packet provided as data exchanged within the network system via the tap 92. The server 91 and the terminal apparatuses 94 are connected to one another via nodes. In FIG. 15, a core node is designated by the reference numeral N1, a network achieved through a node N2 connected to the core node N1 is determined to be a subnet A, and a network achieved through a node N3 which is connected to the core node N1 and is different from the node N2 is determined to be a subnet B. Here, the term “core node” will be described. When the network is regarded as a tree structure, only a node is connected to the lower link of the core node. Each of the above-described terminal apparatuses 94 belongs to either of the subnets A and B. The flow of data transmitted from the server 91 to the terminal apparatus 94 belonging to the subnet A is determined to be a flow F1, and that of data transmitted from the server 91 to the terminal apparatus 94 belonging to the subnet B is determined be a flow F2.
In the above-described network system, the monitoring apparatus 93 calculates variations in a delay time relating to the data exchange for each of the flows F1 and F2 based on the packet acquired via the tap 92. Next, the monitoring apparatus 93 determines whether or not an irregularity occurs in each of the flows F1 and F2 based on a threshold value and the variations in the delay time. Here, the threshold value is the variation rate determined for each of the flows F1 and F2, and when the value of the variation rate of the delay time is equivalent to and/or larger than the determined threshold value, it is determined that the irregularity occurs in the corresponding flow. For example, when the delay time of the flow F1 is changed from 20 ms to 40 ms and the threshold value is 200%, it is determined that the irregularity occurs in the flow F1. When the delay time of the flow F2 is changed from 1000 ms to 1020 ms and the threshold value is 101%, it is determined that the irregularity occurs in the flow F2.
Next, the monitoring apparatus 93 maps regular/irregular information for a node via which the flow passes based on the above-described determinations. The regular/irregular information illustrates whether or not the flow is regular. After the mapping is performed, the monitoring apparatus 93 determines the set of nodes covering an irregular flow by the minimum number of nodes to be the irregular location. For example, when each of the flows F1 and F2 is determined to be the irregular flow as described above, the core node N1 covering the flows F1 and F2 is specified as the irregular location. During the irregular location specification, a node covering a regular flow is excluded.
For example, “Empirical Study on Locating Congested Segments over the Internet Based on Multiple End-to-End Path Measurements”, IEICE Technical Report, vol. 104, no. 309, CQ2004-76, pp. 43-48, September 2004. has been disclosed as one the above-described technologies for specifying the irregular location in the network.
However, it has often been difficult to specify the irregular location with precision according to the above-described technologies for specifying the irregular location. When the threshold value provided to determine whether or not an irregularity occurs in the flow is low, the flow is determined to be regular even though the flow should be determined to be irregular. For example, when the threshold value set for the flow F2 is 110% in the above-described network system, the flow F2 is not determined to be the irregular flow. As a result, only the flow F1 is determined to be the irregular flow. Since the core node N1 covers the flow F2, only the node N2 is determined to be the irregular location, because the delay time is measured in flows. Further, since the delay time is measured in nodes, a heavy load is put on the network when all of the nodes are monitored.